Information Management Assessment

Action plan progress review

Northern Ireland Office

Reviewed September 2017

Published December 2017

Working with government to raise standards in information management Contents

Background and action plan development 00 Executive summary 00 Progress to address recommendations and risk areas 00 Next steps 00

© Crown copyright 2017.

You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0.

Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk Background

The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management.

The Northern Ireland Office (NIO) IMA took place in February 2016. This progress review summarises key developments since the IMA. Areas where continued attention is still needed are listed below under ‘Next Steps.’

Action plan development

NIO produced a detailed action plan in summer 2016 and reported on delivery of this to the departmental Audit and Risk Committee. This is a good practice approach to ensuring senior scrutiny of progress to address recommendations and improve capability in information and records management. NIO’s IMA and action plan were covered in the department’s annual report and accounts for 2016/17 under the heading of risk management and control, reflecting the importance attached to participation in our programme.

The National Archives formally assessed progress against the action plan in September 2017. The IMA report and action plan are both published on The National Archives’ website.¹

¹ http://www.nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/ Executive summary

Value of information

- The Northern Ireland Office (NIO) continues to promote the importance of records management to its staff through briefings, workshops and guidance and has reviewed and updated its Knowledge and Information Management Strategy.
- NIO’s approach to information asset management has continued to improve with the formalisation of the Information Assurance Coordinator role, updated and improved guidance and training for Information Asset Owners and the beginning of work to review the Information and Data Asset Registers.

Digital information and supporting technology

- As predicted at the time of the IMA, the upgrade of NIO’s system for electronic management from TRIM to Content Manager 9 (CM9) and move to a Google platform and the incompatibility between these two tools has had a negative impact on work practices and records capture within NIO. NIO is working hard to mitigate this through technical solutions, training, guidance and support and should continue to monitor the situation carefully.
- NIO has recognised the need for greater skills and support to ensure that digital information is managed effectively throughout its lifecycle and are restructuring the Records and Information Management team to meet this need.

Information risk, governance and oversight

- NIO has made progress in raising the profile of information risk but needs to recognise that this is an ongoing task.
- The Records and Information Management team have worked extremely hard to support staff in records and information management through guidance and training. Policy and guidance relating to information and records management has been updated to reflect the move to Google and CM9.
- NIO is yet to develop a formal approach to monitoring compliance with the information management policy.

Records review and transfer

- NIO has streamlined its approach to appraisal and selection of paper records which is enabling it to better keep pace with the transition to the 20 Year rule and move towards compliance with the Public Records Act. By documenting its approach and capturing the knowledge of reviewers it is ensuring that it has the capability to carry out this work in the long term.
- NIO has made good progress in laying the foundations for disposal of its digital information, both in terms of starting to think about skilling the team to carry out the appraisal, selection and transfer of digital information and in preparing to apply disposal instructions to information on CM9. Progress to address recommendations and risk areas

1 The value of information

| Performance rating | IMA 2016 | Review 2017 | |--------------------|----------------|---------------------------------| | Communicating and realising value | Good practice | Good practice | | Managing information as an asset | Satisfactory | Progressing towards good practice |

Situation at the time of the IMA

- The Northern Ireland Office (NIO) had a strong culture of information and records management and information security but needed to ensure that this was maintained as the department moved to more open and flexible working.

- A Knowledge and Information Management (KIM) strategy for 2015-20 had been drafted and was awaiting sign off.

- NIO had made a good start on building a process for the management of its information assets but needed to embed this across the organisation including training and guidance for Information Asset Owners (IAO).

- The Knowledge and Information Strategy was signed off in June 2016. It was reviewed and updated in June 2017 and no substantial changes were made. See next steps

- Work to promote good records management practice includes briefings for staff at induction, reminders at Deputy Directors’ meetings and at business area/team briefings and fun approaches such as the board game on records transfers and the six simple rules for information management.

- The Information Assurance Coordinator (IAC) role has been formalised and NIO is now adopting a more active approach to information asset governance. The IAC delivers one-to-one briefings to Information Asset Owners, explains the responsibilities of an IAO and makes available the links to NIO guidance. The IAC also checks that all IAOs have undertaken mandatory Civil Service learning on information handling.

- IAO guidance has been reviewed and an IAO questionnaire has been developed along with a one page overview of IAO responsibilities. The role is held at deputy director level and is now recognised in performance management objectives. See next steps

- NIO is currently reviewing the Information and Data Asset Registers (IDARs) and gathering feedback from IAOs, in particular on how adequately the registers document information risk. 2 Digital information and supporting technology

| Performance rating | IMA 2016 | Review 2017 | |--------------------|-------------------|----------------------| | Supporting information through technology | Development area | Development area | | Digital continuity and IT change | Development area | Progressing towards satisfactory |

Situation at the time of the IMA

- NIO was about to undergo a major change in its technology environment as it moved to a new IT platform including Google and mobile technology. There were concerns about the impact of this on the use of NIO’s established system for digital records management, TRIM, and on the management and handling of digital information more generally.

- NIO needed to start developing a strategy/plan for dealing with older digital information in TRIM and on shared drives including an approach for appraisal, selection and transfer of records of historical value to The National Archives.

- As anticipated at the time of the IMA the upgrade from TRIM to CM9 and move to a Google platform and the lack of integration between these two tools has had an impact on work practices and records capture within NIO. There is no simple way to move emails/documents between Google Drive/Gmail and CM9 and NIO has had to devise workarounds. Statistics show growing use of Google Drive. NIO needs to monitor the situation carefully and continue to mitigate risks around record capture through strategy, policy, training, guidance and support whilst exploring a more long term solution. See next steps

- The 90 day deletion of emails has not been activated since the move to Gmail to minimise any loss of important emails as the department adjusts to this new system.

- NIO has tested DROID (The National Archives file profiling tool) and found it a useful tool for finding out about the digital information that is held including age, format, dates etc. However, due to the manual work needed to use the information created by DROID, NIO is also starting consider testing other e-discovery tools. Further work on this has been deferred until 2018. See next steps

- NIO has taken steps to resource the KIM team to focus efforts on managing digital continuity and grow skills in this area (See section 5). This is good practice 3 Information risk, governance and oversight

| Performance rating | IMA 2016 | Review 2017 | |--------------------|----------------|---------------------------| | Recognising information risk | Development area | Progressing towards satisfactory | | Establishing control | Satisfactory | Satisfactory | | Providing guidance | Satisfactory | Good practice | | Measuring impact | Development area | Development area |

Situation at the time of the IMA

- NIO’s approach to information risk, particularly risks relating to information management was fragmented. Information risk in its wider sense was not necessarily understood across the organisation or recognised at Board level.

- The Records and Information Management (R&IM) team provided a good service to the business and there was a clear plan in place for KIM work.

- NIO had good policies and guidance in place for information management but needed to ensure that these were updated in line with the move to a new IT environment and mobile working.

- NIO was yet to develop an approach to monitoring compliance with information and records management policy.

- Information risk is now a permanent agenda item for the Departmental Security Committee, which meets every six weeks. In addition a report on information assurance goes to the Audit and Risk Committee twice a year and Directors are expected to report any information risks in monthly dashboards which are submitted to the Executive Management Committee. Also positive to see that a risk around management of digital information was included in the top prioritised NIO risks for June 2017.

- The IAC is developing a process for IAOs to report on information risk and mitigation via the quarterly IDAR updates. See next steps

- The complicated nature of the workarounds required to make record keeping work within Google and CM9 has meant extra pressure on information management staff to prepare guidance, deliver training and provide ongoing support. This has impacted on their ability to deliver other work in particular measuring compliance with records management policy. See next steps

- The Information Management Policy has been updated to reflect the move to Google and CM9 and now includes a section on social media. This is good practice

- In addition to comprehensive guidance on how to use CM9, NIO has produced succinct and easy to read guidance on social media and safe handling of information, managing email (‘Get it Filed’), and on naming conventions. NIO also plans to review its guide to remote working later in 2017/18. This is good practice • Record Retention/Disposal Schedules have been completed for all business areas and most are now published on the NIO intranet. NIO should now publish these on GOV.UK as recommended by Sir Alex Allan in his Report on Records Review. See next steps • The situation around facilities for training remains difficult though new kit has helped and there is now a dedicated room in Belfast that can be used for training. • Statistics gathered on systems use give an indication of records management practice but NIO has yet to progress work on monitoring compliance with information and records management policy. See next steps

4 Records, review and transfer

| Performance rating | IMA 2016 | Review 2017 | |----------------------------------------|----------------|-------------| | Oversight of records and selection | Satisfactory | Good practice | | Implementing disposal decisions | Development area | Satisfactory |

Situation at the time of the IMA

• NIO had a team of knowledgeable and experienced part-time file reviewers who carry out appraisal and selection and sensitivity review of paper files to be transferred to The National Archives. • However, there was no overall departmental guidance for appraisal and selection or sensitivity review and NIO needed to capture and document the knowledge of its reviewers. • NIO was slightly behind in its transition to the 20-year rule, was starting to plan to address this as well as an increase in the volume of paper files. • NIO was not yet able to apply auto disposal to TRIM and needed to develop an approach for the appraisal and selection and sensitivity review of digital information and ensure that it acquired new skills within the team to be able to carry out this work.

• Steps are being taken to capture the knowledge of reviewers, for example, the review team have produced ‘A Guide to Sensitivity Review’ and a summary of key events in Northern Ireland from the early 1970s to the early 2000s. This is good practice • The transfer team trialled and then adopted a new macro method of records appraisal. NIO reported that this has resulted in a 30% reduction in time spent on close scrutiny review. As a result the team is about to finish reviewing the 1991 records. This is good practice. NIO needs to ensure this progress continues in order to move towards compliance with the 20 Year Rule and Public Records Act. See next steps • Approval was given in August 2017 to expand KIM team resource to create two new Digital Continuity Officer posts to enable the team to increase focus on the continuity of digital records and to ensure readiness for digital transfers to The National Archives by 2024. The post of System Administrator has also been upgraded to recognise greater responsibility for digital continuity issues. Five NIO staff have also attended the digital transfer training at The National Archives. **This is good practice**

- NIO is in the process of transitioning to a new paper storage contract which will also include preparation of files for transfer. Moving this work to a contractor should ease pressure on the Records and Information Management team. NIO should ensure that it has a process in place for quality assuring this work. **See next steps**

- NIO needs to develop an approach to appraisal, selection, sensitivity review and transfer of digital information across all systems. The collection of confidential records that have recently been identified may be prove to be a good set of records to develop and test the process of digital transfer and NIO should work with The National Archives on this. **See next steps**

- The project to reduce the file plan within CM9 to a single level has been completed but there is a further work that needs to be done before retention periods can be applied to this. NIO have identified a business area to test this out with in the coming months. **See next steps** Next Steps

The National Archives will continue to support the Northern Ireland Office (NIO) in its work on information and records management. Outstanding recommendations will be reviewed at the time of the department’s IMA reassessment. It is recommended that NIO focusses on the following:

- Review the IMA strategy to ensure appropriate direction is set to tackle key cultural and IT related challenges.
- Update Information Asset Owner (IAO) guidance as NIO’s approach to information security develops. NIO should tailor the IAO handbook to reflect its own requirements, following the example of other IMA programme members such as the Ministry of Justice and Home Office.
- Continue to develop and improve the Information and Data Asset Register.
- Continue to raise the profile of information risk and increase understanding of this.
- Monitor the situation around incompatibility with CM9 and Google carefully and continue to mitigate risks around record capture through training, guidance and support whilst exploring a more long term solution to the problem.
- Update guidance on remote working and ensure that this covers information and records management.
- Develop a proportionate approach to monitoring compliance with information and records management policy. Good practice approaches within the IMA programme include HM Treasury.
- Ensure that it has a process in place to quality assure file preparation work carried out by the outside contractor.
- Keep pace with the transition to the 20 Year Rule by continuing its more streamlined approach to appraisal and selection.
- Put in place a plan to apply disposal instructions to the file plan in CM9. NIO needs to develop an approach to appraisal, selection, sensitivity review and transfer of digital information across all systems perhaps starting with confidential records.